@integrity-labs/agt-cli 0.28.732 → 0.28.733

package/dist/bin/agt.js

@@ -41,12 +41,12 @@ import {
   success,
   table,
   warn
-} from "../chunk-DGIYNBDG.js";
+} from "../chunk-LT7UGH4O.js";
 import {
   getProjectDir,
   isSessionResumeDisabled,
   readDirectChatSessionState
-} from "../chunk-QB6TIA3Z.js";
+} from "../chunk-7KT2QNXF.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -79,7 +79,7 @@ import {
   serializeManifestForSlackCli,
   sessionFileExists,
   sessionTranscriptDir
-} from "../chunk-BADE2W6M.js";
+} from "../chunk-IBBBIE4K.js";
 import "../chunk-XWVM4KPK.js";
 
 // src/bin/agt.ts
@@ -5467,7 +5467,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync11, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.732" : "dev";
+var cliVersion = true ? "0.28.733" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6654,7 +6654,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.732" : "dev";
+var cliVersion2 = true ? "0.28.733" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-QB6TIA3Z.js → chunk-7KT2QNXF.js}

@@ -17,7 +17,7 @@ import {
   rotateDailySession,
   sessionFileExists,
   todayLocalIso
-} from "./chunk-BADE2W6M.js";
+} from "./chunk-IBBBIE4K.js";
 import {
   reapOrphanChannelMcps
 } from "./chunk-XWVM4KPK.js";
@@ -4880,4 +4880,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-QB6TIA3Z.js.map
+//# sourceMappingURL=chunk-7KT2QNXF.js.map

package/dist/{chunk-BADE2W6M.js → chunk-IBBBIE4K.js}

@@ -5482,7 +5482,22 @@ var FLAG_REGISTRY = [
     // seeding code, so `listNewOrgFlagOverrides()` is the one answer to "which flags
     // does a new org get". `defaultValue` stays false so the ~4 months of orgs already
     // carrying an inert enforce-level email.require_approval row are NOT armed on deploy.
-    newOrgOverride: true
+    newOrgOverride: true,
+    // ENG-9630: API-created organizations only, and this is a deliberate,
+    // reviewed asymmetry rather than an oversight.
+    //
+    // Arming this holds EVERY dispatching send for human approval. The hold
+    // itself works fine on a self-serve org — `hitl-approval-routing` has
+    // defaulted to 'on' since ENG-7828, so a real Human Approval card is minted
+    // and it is actionable at /organization/approvals. What a self-serve org
+    // does NOT have is any means of being TOLD: no Slack alert channel is wired
+    // at signup, so the card sits in a console surface nobody has pointed the
+    // user at, and their agent's first email silently waits on it.
+    //
+    // So the blocker is the notification path, not the control. Whoever revisits
+    // this should treat "a self-serve org actually receives the card" as the
+    // prerequisite and then drop this line — do not simply widen it.
+    newOrgOverrideOrigins: ["api"]
   },
   {
     key: "mail-rule-control-enforcement",
@@ -7800,7 +7815,11 @@ var ORG_ROLE_PERMISSIONS = {
     "org.manage_teams",
     "org.manage_guardrails",
     "org.manage_integrations",
-    "org.view_audit_log"
+    "org.view_audit_log",
+    // ENG-9486 (ADR-0074). Authoring is owner+admin, matching every other action
+    // that can write a secret or change what an org is billed for.
+    "org.manage_model_policies",
+    "org.assign_model_policies"
   ],
   admin: [
     "org.manage_settings",
@@ -7808,7 +7827,9 @@ var ORG_ROLE_PERMISSIONS = {
     "org.manage_teams",
     "org.manage_guardrails",
     "org.manage_integrations",
-    "org.view_audit_log"
+    "org.view_audit_log",
+    "org.manage_model_policies",
+    "org.assign_model_policies"
   ],
   member: [
     "org.manage_teams",
@@ -12995,4 +13016,4 @@ export {
   peekCurrentSession,
   readDailySessionPin
 };
-//# sourceMappingURL=chunk-BADE2W6M.js.map
+//# sourceMappingURL=chunk-IBBBIE4K.js.map